diff --git a/.github/workflows/ci-copier.yml b/.github/workflows/ci-copier.yml
index 7decded..9bbee86 100644
--- a/.github/workflows/ci-copier.yml
+++ b/.github/workflows/ci-copier.yml
@@ -57,7 +57,7 @@ jobs:
     permissions:
       contents: read
       # Read and cancel the generated package's runs. Pushing goes through
-      # `CI_PAT`, not this token.
+      # the app token, not this token.
       actions: write
     strategy:
       matrix:
@@ -76,18 +76,25 @@ jobs:
         id: branch
         run: |
           echo "name=ci/$GITHUB_SHA-${{ matrix.minimal-python-version }}" >> $GITHUB_OUTPUT
+      - name: Create the app token
+        id: app
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.BOT_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+          permission-contents: write
+          permission-workflows: write
       - name: Test generated package CI
         env:
           # Reading and cancelling the generated package's runs.
           GH_TOKEN: ${{ github.token }}
-          # A fine-grained token limited to this repository. `GITHUB_TOKEN`
-          # can neither push files under `.github/workflows/` nor start a
-          # workflow by pushing; a push made with `CI_PAT` does both.
-          CI_PAT: ${{ secrets.CI_PAT }}
+          # `GITHUB_TOKEN` can neither push files under `.github/workflows/`
+          # nor start a workflow by pushing; a push made with the
+          # `energy-models-bot` app token does both.
+          APP_TOKEN: ${{ steps.app.outputs.token }}
           BRANCH: ${{ steps.branch.outputs.name }}
           MINIMAL_PYTHON_VERSION: ${{ matrix.minimal-python-version }}
         run: |
-          : "${CI_PAT:?the CI_PAT secret is not set}"
           AUTH="authorization: Bearer $GH_TOKEN"
           # Set up local Git so that copier can run "git commit".
           git config --global user.email "landocalrissian@example.com"
@@ -111,7 +118,7 @@ jobs:
           git add .
           git commit -m "Initial commit"
           cid=$(git rev-parse HEAD)
-          git push -f "https://x-access-token:$CI_PAT@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" "$cid:refs/heads/$BRANCH"
+          git push -f "https://x-access-token:$APP_TOKEN@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" "$cid:refs/heads/$BRANCH"
           # Wait for the generated package's CI to complete (success or failure).
           WORKFLOW_URL="$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/runs?branch=$BRANCH&head_sha=$cid&event=push"
           echo "Waiting for inner CI to start"
@@ -131,7 +138,7 @@ jobs:
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
-          CI_PAT: ${{ secrets.CI_PAT }}
+          APP_TOKEN: ${{ steps.app.outputs.token }}
           BRANCH: ${{ steps.branch.outputs.name }}
         run: |
           AUTH="authorization: Bearer $GH_TOKEN"
@@ -141,7 +148,7 @@ jobs:
             curl -Ls --header "$AUTH" --request POST "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/runs/$run_id/cancel" > /dev/null
           done
           # Delete the branch. Tolerate it never having been created.
-          git push -d "https://x-access-token:$CI_PAT@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" "refs/heads/$BRANCH" || true
+          git push -d "https://x-access-token:$APP_TOKEN@${GITHUB_SERVER_URL#https://}/$GITHUB_REPOSITORY.git" "refs/heads/$BRANCH" || true
 
   finalize:
     name: Test CI of generated package (all)